Threats · 4h ago
Sekoia uncovered in mid-October 2026 a campaign it attributes with moderate-to-high confidence to APT29: a compromised Ukrainian analytics service exposed visitors across hundreds of legitimate sites to exploit delivery for one week. The campaign also used directly compromised websites and attacker-controlled lookalike domains.
The analytics script ran in visitors’ browsers, profiled their device and browser, then sent them to a delivery server that selected a matching exploit—no click required. Sekoia says the payloads stole cookies or full device data from iOS devices, and Chrome data and Wi-Fi passwords from Android devices, without leaving a persistent implant.
For organizations whose sites loaded that supplier, the exposure reached visitors, not just site owners. Organizations whose people visited during the week may inherit data-theft exposure even though the reported payloads left no persistent malware.
CVEs in this update
8 CVEs
Across Chrome, safari, ipados, and related packages.
0 critical · 6 high · 2 medium · 0 low
7 in CISA KEV · 5 with EPSS above 1%
Highest severity: CVE-2025-14174 · 8.8 HIGH
Highest EPSS: CVE-2025-14174 · 55.3%
4 sources covering this story
Russian hackers target iOS and Android users with n-day exploits - Help Net Security
Russia’s APT29 used compromised sites and a hijacked Ukrainian analytics tracker to hit unpatched mobile devices with n-day exploits.
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29-linked attackers use compromised sites and Plerdy analytics to deliver iOS and Android exploits that steal browser and device data.
APT29 Watering Holes Target Unpatched iPhones and Android Devices
APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users
Poisoned Source: APT29 Watering Holes Targets Mobile Devices
Uncover how APT29 launched a massive watering hole campaign using iOS and Android exploit chains to steal sensitive mobile data.
Part of the PlainSec briefing for 2026-11-04